core: Authorization SPI Refactor (Draft) #3681
Conversation
| op, | ||
| rootContainerWrapper, | ||
| null /* secondary */); | ||
| AuthorizationCallContext authzContext = new AuthorizationCallContext(resolutionManifest); |
There was a problem hiding this comment.
Would it be possible to inject it from CDI? Ideally resolutionManifest should also be a request-scoped (auto-created) bean, but for a start we could add it to AuthorizationCallContext manually since AuthorizationCallContext is expected to be mutable anyway 🤔 WDYT?
There was a problem hiding this comment.
Hi @dimas-b - great suggestion.
Yes, I think that aligns well with the proposed strategy to define the Resolution semantics at request-scope instead, and build consistency guarantees on it. I think creating a request-scoped bean for AuthorizationCallContext would be safe, and we can evaluate if we can do the same for the resolution semantics after a dedicated design proposal on the Resolution/Persistence model
2 participants
This is a Draft PR I prepared to aid reviewing the new Authorization SPI Refactoring RFC
Checklist
CHANGELOG.md(if needed)site/content/in-dev/unreleased(if needed)